The present invention relates to a circuit arrangement which is intended for use in safety-critical control systems and comprises a microprocessor system including two or more central processor units or CPUs and by which input signals are evaluated and control signals are generated by data processing, that is at least in part redundant. Input data are processed in parallel and the results of the parallel, redundant data processing are compared and, in the absence of proper correlation, signals are generated for error identification or disconnection and disablement of the control system.
European patent application No. 0 496 509 discloses a circuit arrangement of this type which, exactly as the present invention, is intended for the control of an automotive vehicle anti-lock system. The information obtained by way of wheel sensors is processed in parallel in two microprocessors and the data processing results of the two microprocessors are correlated by another microprocessor to produce an error identification signal when the results differ. The anti-lock control system is disconnected in the presence of an error in order to ensure at least the conventional braking function.
German patent No. 32 34 637 discloses another example of a circuit arrangement of this type which is also used to control and monitor an anti-lock vehicle brake system. In this patent specification, the wheel sensor signals are supplied in parallel to and synchronously processed in two identically programmed microcomputers. The output signals (and intermediate signals) of the two microcomputers are checked for correlation to produce an error identification signal. One of the two microcomputers in this known circuit serves to generate braking pressure control signals and the other one serves to produce test signals. In this concept, a second microcomputer, that is identical in design and programming with the first microcomputer, is necessary especially for identification of a data processing error.
In still another prior art circuit arrangement disclosed in German patent publication No. 41 37 124, the input data are supplied to two microcomputers, of which only one performs the complete intricate signal processing operation. The second microcomputer mainly has a monitoring function. Therefore, the input signals are processed further after conditioning and after the generation of time derivatives by way of simplified control algorithms and a simplified control philosophy. The simplified processing is sufficient to generate signals which, by comparison with signals processed in the more sophisticated microcomputer, permit concluding proper operation. Although the cost of manufacture can be reduced by using a low-performance test microcomputer, in comparison with a system having two microcomputers of identical performance, the effort needed for error identification is still considerable.
Further, it is known in the art, for example, from U.S. Pat. No. 4,277,844 to write test information to a memory space and to compare the contents of the memory space with associated test information.